d5c01af272dc1bf6bb598d7a1500aeed708d307af1f698b665a863ac8e4964a6

Analysis

max time kernel
35s
max time network
28s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 20:19

Target

NEAS.fc9ff78dbe99e8dfae49727912e53910.dll
Size

76KB
MD5

fc9ff78dbe99e8dfae49727912e53910
SHA1

9de5860ce89953c82c1b01e6d4ce800832f33de4
SHA256

d5c01af272dc1bf6bb598d7a1500aeed708d307af1f698b665a863ac8e4964a6
SHA512

f28075dd1c9dea9b80ce3f4b9bc777b4304f6a79f3cd2009ac3d34cd6c11678a39ae8510ab775a5ed0b9712287ae77af848b7054eeb9e01b47765101729447fe
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZBt5L3Pw:c8y93KQjy7G55riF1cMo0333I

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2780-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2780-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2780	2764	rundll32.exe	29
PID 2764 wrote to memory of 2780	2764	rundll32.exe	29
PID 2764 wrote to memory of 2780	2764	rundll32.exe	29
PID 2764 wrote to memory of 2780	2764	rundll32.exe	29
PID 2764 wrote to memory of 2780	2764	rundll32.exe	29
PID 2764 wrote to memory of 2780	2764	rundll32.exe	29
PID 2764 wrote to memory of 2780	2764	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.fc9ff78dbe99e8dfae49727912e53910.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.fc9ff78dbe99e8dfae49727912e53910.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2780

memory/2780-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2780-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download